Digital advertising practices like real-time bidding (RTB) and programmatic trading allow personal data to be widely shared without user consent. During RTB, a user's data can be sent to hundreds of companies each web visit via a complex supply chain including exchanges, data management platforms, demand-side platforms, and suppliers. This widespread data sharing and lack of transparency undermine user privacy and could violate regulations like the GDPR which require separate consent for each use of personal data.

1. DIGITAL
ADVERTISING AIN’T
VERY ETHICAL
Dr Johnny Ryan @johnnyryan

2. Problem Set 1:
The “Facebook and Cambridge
Analytica Problem”
How to protect personal data
when it is shared with 3rd parties?

3. Control
Problem
Images hosted on other domains
Embedded videos
Social sharing widgets
Fonts and other resources
loaded from other domains
Commenting widgets
3rd party audio players, etc.

4. Control
Problem

5. Control
Problem

6. How RTB/
programatic works

7. “Behavioural” ad targeting
& “programmatic” trading.

8. “Behavioural” ad targeting
& “programmatic” trading.
(This jargon means: automatic auctions for the right
people’s attention)

9. ///
Visitor Site Advertiser
$

10. ///
Visitor Site SSP DSP DMP Advertiser
$
“Demand side”“Supply side”
Ad Exchange

11. ///
Visitor Site SSP DSP DMP Advertiser
$
“Demand side”“Supply side”
Ad Exchange

12. store data
///
Visitor Site SSP DSP DMP Advertiser
$
“Demand side”“Supply side”
Ad Exchange

13. request segment
store data
///
Visitor Site SSP DSP DMP Advertiser
$
“Demand side”“Supply side”
Ad Exchange

14. request segment
deliver segment
store data
///
Visitor Site SSP DSP DMP Advertiser
$
“Demand side”“Supply side”
Ad Exchange

15. request page
request segment
deliver segment
store data
///
Visitor Site SSP DSP DMP Advertiser
$
“Demand side”“Supply side”
Ad Exchange

16. serve page
request page
request segment
deliver segment
store data
///
Visitor Site SSP DSP DMP Advertiser
$
“Demand side”“Supply side”
Ad Exchange

17. serve page
request page
request segment
deliver segment
Ad request
store data
///
Visitor Site SSP DSP DMP Advertiser
$
“Demand side”“Supply side”
Ad Exchange

18. serve page
request page
request segment
cookie to SSP
deliver segment
Ad request
store data
///
Visitor Site SSP DSP DMP Advertiser
$
“Demand side”“Supply side”
Ad Exchange

19. serve page
request page
request segment
ad request
cookie to SSP
deliver segment
Ad request
store data
///
Visitor Site SSP DSP DMP Advertiser
$
“Demand side”“Supply side”
Ad Exchange

20. serve page
request page
request bid
request segment
ad request
cookie to SSP
deliver segment
Ad request
store data
///
Visitor Site SSP DSP DMP Advertiser
$
“Demand side”“Supply side”
Ad Exchange

21. serve page
request page
request bid
request segment
ad request
cookie to SSP
deliver ad
deliver segment
Ad request
store data
///
Visitor Site SSP DSP DMP Advertiser
$
“Demand side”“Supply side”
Ad Exchange

22. serve page
request page
request bid
request segment
ad request
cookie to SSP
deliver ad
deliver segment
sync
Ad request
store data
///
Visitor Site SSP DSP DMP Advertiser
$
“Demand side”“Supply side”
Ad Exchange

23. serve page
request page
request bid
request segment
ad request
cookie to SSP
deliver ad
sync
deliver segment
sync
Ad request
store data
///
Visitor Site SSP DSP DMP Advertiser
$
“Demand side”“Supply side”
Ad Exchange

24. Buyer Seller
•Hoovers up 70-55% of
buyer’s media budget2
Distributon
•Tiny 4% revenue
increase1
•5x price increase1
Advertiser
$ DMP DSP Ad Exchange SSP Site
•Their unique audience
is commodified
•Siphons publisher
inventory
(enables “click bait”)
///
Visitor
Inventory
1 Alessandro Acquisti, presentation at FTC Hearing 6 - Competition and Consumer Protection in the 21st Century - The Intersection of Big Data, Privacy, and Competition - Session 2, 6 November 2018
2 70% figure from the Guardian and Rubicon case in 2017. 55% figure from “The Programmatic Supply Chain: Deconstructing the Anatomy of a Programmatic CPM”, IAB, March 2016.
•Loss of privacy
•Decline in choice and
quality
•Unknown budget
wastage from botfraud

25. The Daily Bugle

26. The Daily Bugle
ExchangeExchange
Exchange
Exchange

27. The Daily Bugle
ExchangeExchange
Exchange
Exchange
DSP
DSP
DSP
DSP
DSP
DSP
DSP
DSP
DSPDSP
DSP DSP
DSP

28. The Daily Bugle
ExchangeExchange
Exchange
Exchange
DSP
DSP
DSP
DSP DMP
DSP
DSP
DSPDMP
DMP
DSP
DSPDSP
DSP DSP
DSP

29. The Daily Bugle
ExchangeExchange
Exchange
Exchange
DSP
DSP
DSP
DSP DMP
DSP
DSP
DSPDMP
DSP
DSPDSP
DSP DSP
DSP
ADVERTISEMENT
DMP

30. The Daily Bugle
ExchangeExchange
Exchange
Exchange
DSP
DSP
DSP
DSP DMP
DSP
DSP
DSPDMP
DMP
DSP
DSPDSP
DSP DSP
DSP?
?
?
?
?
?
ADVERTISEMENT
?

31. The Daily Bugle
ExchangeExchange
Exchange
Exchange
DSP
DSP
DSP
DSP DMP
DSP
DSP
DSPDMP
DMP
DSP
DSPDSP
DSP DSP
DSP?
?
?
?
?
?
ADVERTISEMENT
?

32. The Daily Bugle
ExchangeExchange
Exchange
DSP
DSP
DSP
DSP DMP
DSP
DSP
DSPDMP
DMP
DSP
DSPDSP
DSP DSP
DSP?
?
?
?
?
?
ADVERTISEMENT
?
Exchange
Example

33. French regulator caught it with
68 million illegal RTB records.
Example
Vectaury: a small DSP/DMP/
trading desk in France. €3.5M
annual turnover in 2017 (but
recently had a €20M investment).
DSP

36. Is 68 million
just 30%?
Then this small company
was sent personal data
¼ BILLION times via RTB.
In one single year.

37. Ad server SSP
Step 2.
Ad server
selects an SSP
Step 3.
SSP selects an
exchange
Step 7.
DSP serves
agency creative
Step 8.
Assets load
from CDN
Step 9.
Agency ad server
loads verification
vendor
ADVERTISERS
website.com
AD
DSP
DSP
DSP
DSP
DSP
DSP
DSP
DSP
DSP
DSP
DSP
DSP
DSP
DSP
DSP
DSP
DSP
DSP
DSP
DSP
DSP
Winningbid
DSP
Ad server
javascript
SSP
javascript
DMP
DMP
DMP DMP
DSP
DSP
DSP
DSP
DSP
DSP
javascript
Ad server
javascript
Step 6.
Exchange serves
winning bid
Verification
javascript
Agency
ad server
Verification
vendor
Winning DSP
Step 1.
User requests
webpage
Ad exchange
Channel of data leakage
Personal data
Legend
Step 4.
Exchange sends
bid requests to
hundreds of
partners
Step 5.
Exchange lets
some DMPs/
DSPs to refresh
cookie sync
CDN
Money
This is the current process of
real-time bidding that is used
in online behavioural
advertising.
DATA LEAKAGE
IN ONLINE
ADVERTISING

40. RTB IS A DATA
BREACH

41. Problem Set 2:
Consent for ad tracking
97%1 - 80%2 would reject 3rd party ad
tracking (single dialogue)
1. "Research result: what percentage will consent to tracking for advertising?", PageFair, September
2017 (URL: https://pagefair.com/blog/2017/new-research-how-many-consent-to-tracking/)
2. “Europe Online: an experience driven by advertising”, IAB Europe, 2017, p. 7 (URL: https://
www.iabeurope.eu/wp-content/uploads/2017/09/EuropeOnline_FINAL.pdf).

42. IAB Europe non-compliant approach
to a GDPR consent request
[Site] and our partners set cookies and collect
information from your [browser] [device] to provide
you with [website] content, deliver relevant
advertising and understand [web] audiences. [View
partner info]
We use technology such as cookies on our site to
collect and use personal data to personalize
content and ads, to provide social media features
and to analyse our traffic. We also share
information about your use of our site with our
partners who also use technologies such as
cookies to collect and use personal data to
personalize content and ads, to provide social
media features and to analyse our traffic on our
site and across the internet. View info on our
partners and their use of this data. You can always
change your mind and revisit your choices.
OK
Manage use of
your data
Appears to be hard to not
give consent
breach of the GDPR, Article 4, paragraph 11,
and Recital 42, and Recital 32.
No mention of the duration
for which data are stored.
breach of the GDPR, Article 13, paragraph 2, a
No precise description of a
purpose of processing, and
no notification of profiling.
breach of the GDPR, Article 4, paragraph 11,
and Article 13, paragraph 1, c, and paragraph
2, f, and Recital 60.
Conflation of
multiple purposes
breach of the GDPR, Article 5,
paragraph 1, b, Recital 32, and
Recital 43.

43. But the GDPR requires a
separate legal basis
(consent, in this case) for
each processing purpose

44. Website SSP Ad Exchange DSP DMP Advertiser
Fraud
verification
Ad server Analytics
1
To inform the agents of prospective advertisers that you are on visiting the web site, so that the website
can solicit bids for the opportunity to show an ad to you.
Controller Processor Processor
2
To combine your browsing habits with data they already have collected about you (and infer further
insights about you) so that they can select relevant ads for you.
These ads may be for products you have shown interest in previously.
This profile may include your income bracket, age and gender, habits, social media influence, ethnicity,
sexual orientation, religion, political leaning, etc.
Controller Controller Controller Controller Controller
3
To use your browsing habits to build or improve a profile about you, in order to sell these data to partners
for online marketing, credit scoring, insurance companies, background checking services, and law
enforcement.
This profile may include your income bracket, age and gender, habits, social media influence, ethnicity,
sexual orientation, religion, political leaning, etc.
Controller Controller
4 To identify whether you are the kind of person that its advertising clients want to show ads to. Processor Controller Controller
5
To combine your browsing habits with data they already have collected about you (and infer further
insights about you), to personalize the service or product that it offers you.
This may include determining whether to offer you discounts.
This profile may include your income bracket, age and gender, habits, social media influence, ethnicity,
sexual orientation, religion, political leaning, etc.
Controller
6 To monitor your behavior on websites in order to determine if you have viewed or interacted with an ad. Controller Controller Processor
7
To determine whether you have purchased one of its products or services following your viewing of or
interaction with an ad that it has paid for.
Controller
8
To combine your browsing habits with data they already have collected about you (and infer further
insights about you), to verify that you are human rather than a “bot” attempting to defraud advertisers.
This profile may include your income bracket, age and gender, habits, social media influence, ethnicity,
sexual orientation, religion, political leaning, etc.
Controller
9
To record the number of times you have viewed each ad, to prevent a single ad being shown to you too
frequently.
Controller
10
To combine your browsing habits with data they already have collected about you (and infer further
insights about you), to understand how you and people similar to you browse the web.
This profile may include your income bracket, age and gender, habits, social media influence, ethnicity,
sexual orientation, religion, political leaning, etc.
Controller
Each purpose requires its own opt-in.
Examples of the many purposes of data
processing in online behavioral advertising.

45. Gordon House, Barrow
St, Dublin 4, Ireland
Acxiom GmbH
Martin Behaim Strasse 12,
63263 Neu-Isenburg,
Germany
Google Ltd.
Viewing 2 of 251 partners
Help keep Example.com profitable
Learn about your data rights here.
OFF
Let these companies combine your browsing
habits for 6 months with data they already have
collected about you to improve their profile of
you, including by inferring insights, to show you
relevant advertising. (This profile may include
your income bracket, age and gender, habits,
social media influence, ethnicity, sexual
orientation, religion, political leaning, etc.).
Item 1 of 20
View details
View details
Next
Purpose of processing,
and notification of
profiling.
Article 4, paragraph 11, and Article
13, para 1, c, and para 2, f.
Duration
Article 13, para 2, a.
Granular opt-in for several
purposes
Recital 32, and Article 29 Working Party
Guidance November 2017
Details of rights to
complain to
supervisory authority,
and to access, correct,
and transfer data, etc.
Article 13, para 2, b, c, and d.
unambiguous, specific
affirmative action. Not
yes by default.
Article 4, para 11, and Recital 32.
contact details of the
Data controller, and list
of categories of
processor.
Article 13, para 1, a, and Recital 42.
An opt-in for each processing purpose

46. Help keep Example.com profitable
Learn about your data rights here.
Let these companies combine your browsing
habits for 6 months with data they already have
collected about you to improve their profile of
you, including by inferring insights, to show you
relevant advertising. (This profile may include
your income bracket, age and gender, habits,
social media influence, ethnicity, sexual
orientation, religion, political leaning, etc.).
Item 1 of 20 Next
Gordon House, Barrow
St, Dublin 4, Ireland
Acxiom GmbH
Martin Behaim Strasse 12,
63263 Neu-Isenburg,
Germany
Google Ltd. View details
View details
Viewing 2 of 251 partners
“Explicit
consent” (to
process special
categories of data)
Article 9, paragraph 2, a.
This design requires
Two tap / click / drag
actions to signal
consent explicitly
Explicit consent for special categories of personal data
OFF

47. Help keep Example.com profitable
Learn about your data rights here.
Let these companies combine your browsing
habits for 6 months with data they already have
collected about you to improve their profile of
you, including by inferring insights, to show you
relevant advertising. (This profile may include
your income bracket, age and gender, habits,
social media influence, ethnicity, sexual
orientation, religion, political leaning, etc.).
Item 1 of 20 Next
CONFIRM?
Gordon House, Barrow
St, Dublin 4, Ireland
Acxiom GmbH
Martin Behaim Strasse 12,
63263 Neu-Isenburg,
Germany
Google Ltd. View details
View details
Viewing 2 of 251 partners
“Explicit
consent” (to
process special
categories of data)
Article 9, paragraph 2, a.
This design requires
Two tap / click / drag
actions to signal
consent explicitly
Explicit consent for special categories of personal data

48. Help keep Example.com profitable
Learn about your data rights here.
Let these companies combine your browsing
habits for 6 months with data they already have
collected about you to improve their profile of
you, including by inferring insights, to show you
relevant advertising. (This profile may include
your income bracket, age and gender, habits,
social media influence, ethnicity, sexual
orientation, religion, political leaning, etc.).
Item 1 of 20 Next
ON
Gordon House, Barrow
St, Dublin 4, Ireland
Acxiom GmbH
Martin Behaim Strasse 12,
63263 Neu-Isenburg,
Germany
Google Ltd. View details
View details
Viewing 2 of 251 partners
“Explicit
consent” (to
process special
categories of data)
Article 9, paragraph 2, a.
This design requires
Two tap / click / drag
actions to signal
consent explicitly
Explicit consent for special categories of personal data

49. Most people will not
click OK to any of this

50. RISK

51. 5 JUNE 2018

56. PublishersAdvertiser
BRAND & AGENCY RISK
FROM PROGRAMMATIC
ADVERTISING
$
Legend
Money Channel of data leakage Shared liability under GDPR Article 82

57. PublishersSSPsDSPDMPAdvertiser Ad Exchanges
A
Agency
Shared liability under GDPR Article 82
Legend
Money Channel of data leakage
$
BRAND & AGENCY RISK
FROM PROGRAMMATIC
ADVERTISING

58. Data protection-free zone
PublishersSSPsDSPDMPAdvertiser Ad Exchanges
A
Agency
Personal data are broadcast to 10s or 100s of
companies in “RTB” bid requests
Shared liability under GDPR Article 82
Legend
Money Channel of data leakage
$
BRAND & AGENCY RISK
FROM PROGRAMMATIC
ADVERTISING
Taking 70-30% of
ad spend

62. What advertisers
should do

63. CLEAN, SAFE
DATA

64. Fossil Fuel Renewable Energy
N20
C02
Regulatory incentive
NEW CLEAN INDUSTRY
Regulatory disincentive
OLD INDUSTRY

65. Ads (Ethical Data)Ads (Conventional Data)
Personal data Non-personal data
Regulatory disincentive
OLD INDUSTRY
Regulatory incentive
NEW CLEAN INDUSTRY
Fossil Fuel Renewable Energy
N20
C02

66. Ads (Ethical Data)Ads (Conventional Data)
Personal data
Ads (Conventional Data)
Personal data
(with consent and
enforceable protection)
Non-personal data
Small, premium market
//
Regulatory disincentive
OLD INDUSTRY
Regulatory incentive
NEW CLEAN INDUSTRY
+
Fossil Fuel Classic CarsRenewable Energy
N20
C02
+

67. WHERE IS
CONTROL?

68. ‘Big Ivan’ (largest ever
nuke), 1961

69. The centralized network is obviously vulnerable as
destruction of a single node destroys communica-
tion between the end stations.

70. Paul Baran
“On Distributed
Networking” (1962)
a single node

71. Paul Baran
“On Distributed
Networking” (1962)

72. Paul Baran
“On Distributed
Networking” (1962)

73. Google, Amazon,
Facebook, etc.
Re-centralisation

74. DISTRIBUTED?

75. johnny@brave.com
@johnnyryan